The TERENA Academic CA Repository

eIRG Meeting. Dublin, 16/04/2004 Diego R. Lopez – TF-AACE  Task Force on Authentication and Authorisation Coordination for Europe  A middleware coordination activity among European NRENs promoted by TERENA  To provide a forum for exchanging experiencie and knowledge in the areas of AA technologies  To encourage the deployment of interoperable (inter- institutional) AA infrastructures and services in the TERENA community  To coordinate the TERENA community contribution to standardization processes in these areas  Development and deployment of interoperable AAIs

eIRG Meeting. Dublin, 16/04/2004 Diego R. Lopez – TF-AACE Achievements  A survey of the different approaches to AAIs  Agreements on protocols and interoperability requirements  An interoperability assessing system is under development  Initial input to the JRA5 of the GN2 proposal  A survey of the current authentication practices within the European NRENs  Used as input for the current version of the white paper  Liaisons with other groups of interest  Mobility  Videoconferencing and streaming  Grids  The TACAR

eIRG Meeting. Dublin, 16/04/2004 Diego R. Lopez – The Case for the Repository  A common academic root had shown unfeasible  Policies have incompatible purposes and even basic principles  Several applications impose limitations in the certificate verification procedues  Extending the infrastructures usually means cumbersome resigning processes  A common bridge was perceived as too complicated  High costs (even in the "simpler" case of the US Federal BCA)  Few bridge-aware software elements

eIRG Meeting. Dublin, 16/04/2004 Diego R. Lopez – The Goals for the TACAR  Provide a means for building a PKI-based web of trust among the European academic community (and beyond!)  Without the technical and administrative overhead of a root or bridge CA  Based on two basic principles  Keep it simple  Let it happen  Conceived as a collection of certificates  More formalization was rapidly requested and incorporated

eIRG Meeting. Dublin, 16/04/2004 Diego R. Lopez – What the TACAR Currently Provides  A trusted source for  Root certificates/policies for EUGridPMA  Root certificates/policies for other constituencies  The repository is built and updated by means of out-of-band methods  Face-to-face meetings  Required for the initial incorporation  PGP-enabled mail  (Optional) bundles of available certificates  Although problems have been detected with certain combinations of formats and browsers

eIRG Meeting. Dublin, 16/04/2004 Diego R. Lopez – What the TACAR Can Provide in the Future  A single authoritative source for certificates and policies  Complementary of the EUGridPMA services  Simplification of maintenance procedures  A means for extending trust links  Beyond the borders of the Grid community  Beyond the borders of the EU  An anchor for deploying new AA mechanisms  TACAR could act as a trust clearinghouse for (con)federated approaches  A model to experiment with  Lighter than a common root, simpler than a bridge

eIRG Meeting. Dublin, 16/04/2004 Diego R. Lopez – Endorsment of the TACAR The TERENA Academic Certificate Authority Repository (TACAR) is the common repository for storing and validating the CA root certificates for the EUGridPMA constituent Certificate Authorities. An endorsement by the eIRG of the TACAR will be a concrete first step towards common EU polices for authentication for resource access and sharing for e-science.